ttusb2: limit messages to buffer size
authorAlyssa Milburn <amilburn@zall.org>
Sat, 1 Apr 2017 17:34:32 +0000 (14:34 -0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 25 May 2017 12:30:12 +0000 (14:30 +0200)
commit5cbfae4ad3604154efd9e14f3ceddf462b916d84
tree65f59f116f7746d611164c45b48ea5cee9de9d4b
parent9737909ff9d4ff421199e2c2238cadaacf2022cc
ttusb2: limit messages to buffer size

commit a12b8ab8c5ff7ccd7b107a564743507c850a441d upstream.

Otherwise ttusb2_i2c_xfer can read or write beyond the end of static and
heap buffers.

Signed-off-by: Alyssa Milburn <amilburn@zall.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/media/usb/dvb-usb/ttusb2.c